DOCSLIB.ORG

Brno University of Technology Packet

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Brno University of Technology Packet BRNO UNIVERSITY OF TECHNOLOGY VYSOKÉ UČENÍ TECHNICKÉ V BRNĚ FACULTY OF INFORMATION TECHNOLOGY FAKULTA INFORMAČNÍCH TECHNOLOGIÍ DEPARTMENT OF INFORMATION SYSTEMS ÚSTAV INFORMAČNÍCH SYSTÉMŮ PACKET FILTERING USING XDP FILTROVÁNÍ PAKETŮ POMOCÍ XDP TERM PROJECT SEMESTRÁLNÍ PROJEKT AUTHOR Bc. JAKUB MACKOVIČ AUTOR PRÁCE SUPERVISOR Ing. MATĚJ GRÉGR, Ph.D. VEDOUCÍ PRÁCE BRNO 2019 Brno University of Technology Faculty of Information Technology Department of Information Systems (DIFS) Academic year 2018/2019 Master's Thesis Specification Student: Mackovič Jakub, Bc. Programme: Information Technology Field of study: Information Systems Title: Packet Filtering Using XDP Category: Networking Assignment: 1. Get familiar with eXpress Data Path and eBPF technologies. 2. Design a packet filtration mechanism using XDP and eBPF. 3. Implement the design and deploy it in Brno University of Technology networking testbed. 4. Test the performance of your approach and compare it with iptables and ipset tools. Recommended literature: Bharadwaj, R. (2017). Mastering Linux Kernel development: A kernel developer's reference manual. ISBN: 978-1-78588-613-3. Robert Love. 2010. Linux Kernel Development (3rd ed.). Addison-Wesley Professional. ISBN: 978-0-672-32946-3 Requirements for the semestral defence: Items 1 and 2 Detailed formal requirements can be found at http://www.fit.vutbr.cz/info/szz/ Supervisor: Grégr Matěj, Ing., Ph.D. Head of Department: Kolář Dušan, doc. Dr. Ing. Beginning of work: November 1, 2018 Submission deadline: May 22, 2019 Approval date: October 31, 2018 Master's Thesis Specification/21433/2018/xmacko09 Strana 1 z 1 Powered by TCPDF (www.tcpdf.org) Packet Filtering Using XDP Declaration I hereby declare that this thesis was prepared as an original author’s work under the super- vision of Mr. Ing. Matěj Grégr, PhD. All the relevant information sources which were used during the preparation of this thesis are properly cited and included in the list of references. ....................... Jakub Mackovič May 21, 2019 Acknowledgements I would like to thank Mr. Grégr for his professional supervision, for the continuous support that he has provided me for the duration of writing this thesis and for his constructive ideas. Abstract Computer systems which must provide their services with a high availability require cer- tain security measures to remain available even when under packet-based network attacks. Unwanted packets must be dropped or mitigated as early as possible and as quickly as possible. This work analyses the eXpress Data Path (XDP) as a technique for early packet dropping and the extended Berkeley Packet Filter (eBPF) as a mechanism for high-speed packet analysis. Examples of current firewalling practices on Linux kernel based systems are observed and a design and the behavioural goals of a system for high-speed packet filtering based on eBPF and XDP are provided. The implementation of the design isthen described in detail. Finally, results of several performance tests are presented, showing the XDP solution’s performance advatages over contemporary filtering techniques. Abstrakt Počítačové systémy, ktoré musia poskytovať svoje služby s vysokou dostupnosťou vyžadujú isté bezpečnostné opatrenia na to, aby ostali dostupné aj pod paketovými sieťovými útokmi. Nevyžiadané pakety musia byť zahodené čo najskôr a čo najrýchlejšie. Táto práca analyzuje eXpress Data Path (XDP) ako techniku skorého zahodenia paketov a extended Berkeley Packet Filter (eBPF) ako mechanizmus rýchlej analýzy obsahu packetov. Poskytuje sa po- hľad na dnešnú prax v oblasti firewallov v systémoch s linuxovým jadrom a navrhne sa systém rýchlej filtrácie paketov založený na eBPF a XDP. Do detailov popisujeme naim- plementované filtračné riešenie. Nakoniec sa vyzdvihujú výhody XDP oproti ostatným súčasným technikám filtrácie paketov na sérii výkonnostných testov. Keywords XDP, BPF, eBPF, packet filtering, NETX Klíčová slova XDP, BPF, eBPF, filtrovanie paketov, NETX Reference MACKOVIČ, Jakub. Packet Filtering Using XDP. Brno, 2019. Term project. Brno Univer- sity of Technology, Faculty of Information Technology. Supervisor Ing. Matěj Grégr, Ph.D. Rozšířený abstrakt Od počiatku medzipočítačovej komunikácie a od vynájdenia celosvetovej siete Internet sme svedkami čoraz väčšej záťaže sieťových prvkov nielen kvôli prudko rastúcej popularite streamovaných služieb, ale aj kvôli rastúcim počtom útokov na počítačové siete. Je preto dôležité, aby počítače, ktoré na Internete poskytujú kritické služby, vydržali záťaž ako požiadavkov na službu, tak sieťových útokov bez toho, aby prestali svoje služby ponúkať. V tejto práci sa zaoberáme vývinom systému, ktorý by napomohol počítačom bežiacim na dostatočne novom linuxovom jadre so znižovaním účinku sieťových útokov, primárne distribuovaného typu. Ako zvolená je pomerne nová technológia XDP, ktorá definuje isté rozhranie pre ovládače sieťových kariet pre spracovávanie paketov ešte pre tým, než sa z pamäti sieťovej karty nakopírujú do jadra. To rozhranie umožňuje zavolať filtračný program interpretovaný virtuálnym strojom extended Berkeley Packet Filteru. Najprv skúmame súčasné riešenia firewallov v počítačoch založených na linuxovom jadre. Kladieme dôraz na nástroj iptables, ktorý dokáže naplniť takzvané chains pomerne zložitými filtračnými pravidlami. Tieto chains sú konzultované v rozdielnych momentoch životného cyklu paketov v operačnom systéme. Cez PREROUTING a POSTROUTING chainy prechádzajú pakety, ktoré do počítača vchádzajú alebo z neho cez niektoré rozhranie vy- chádzajú, INPUT a OUTPUT chainy sú určené pre pakety, ktoré buď pochádzajú z daného počítača alebo sú preň určené, a nakoniec FORWARD chain je určený pre pakety, ktoré nie sú určené pre daný počítač a sú ním smerované. V iptables sú definované tabuľky filter, nat, mangle, raw a security. Každá z nich obsahuje svoje instancie niektorých zo spomenutých chainov. Tento nástroj umožňuje zadávať pravidlá po jednotlivých IP adresách. Preto bol ako do- provodný program k iptables vyvinutý nástroj ipset, ktorý umožňuje deklarovať rozsahy adries. Tieto rozsahy špecifikované v zadávaných pravidlách nahrádzajú pôvodne veľké množstvá potrebných pravidiel pre vytvorenie zhody pre celé rozsahy adries. V krátkosti spomíname projekt netfilter, ktorý má výkonnosťou prevyšovať iptables a zároveň má byť jeho oficiálnym nástupcom. Je však založený na ňom, hlavne použitím chainov. Následne definujeme Berkeley Packet Filter (BPF) ako základný kameň pre rýchle spra- covanie paketov. Modelom filteru BPF je acyklický orientovaný graf. Tento graf obsahuje jeden prvotný uzol, dva cieľové uzly (prijatie a neprijatie paketu) a zvyšné rozhodova- cie uzly. Necieľové uzly sú abstrahované jednoduchým predikátom nad niektorým poľom paketu. Ak je tento predikát pravdivý, pokračuje sa uzlom pravým ak je nepravdivý, tak ľavým, až kým tento proces nepríde k cieľovému uzlu. V implementácii predstavuje každý uzol sériu jednoduchých inštrukcií načítania dát na adrese a podmieneného skoku a cieľové uzly predstavujú návratové hodnoty boolovského typu true a false. Systém BPF bol pridaný do linuxového jadra vo verzii 2.5. Odvtedy sa na ňom nevykoná- vali žiadne zmeny ani vylepšenia, až kým vo verzii 3.15 bolo vydané jeho rozšírenie s názvom extended BPF (eBPF). Toto rozšírenie reflektuje zmeny v modernom hardware; Šírka reg- istrov BPF bola rozšírená na 64 bitov, ich počet bol zvýšený z dva na desať a bolo umožnené volať istú množinu pomocných funkcií kernelu. Ďalšie vylepšenia, s ktorými eBPF prišlo boli lepší preklad z virtuálnych inštrukcií eBPF na inštrukcie danej architektúry hardware, statická verifikácia programov zakazu- júca napríklad cykly alebo dereferenciu uživateľsky zadaných ukazateľov, systémové volanie BPF, či takzvané mapy, nové dátové typy, ktoré majú eBPF programy k dispozícii. Mapy sú dátové štruktúry typu kľúč-hodnota. Existuje viacero typov týchto máp, ako pole či hashovacia tabuľka, no z hľadiska implementácie filtračného programu nás najviac zaujal typ strom Longest Prefix Match. Ďalej je popísané XDP ako rozhranie pre ovládače sieťových rozhraní, ktoré môžu pomo- cou neho zavolať načítaný eBPF (XDP) program. Ten XDP program má k dispozícii dáta celého príchodizeho paketu, na základe ktorých ako návratovú hodnotu vstupnej funkcie vráti verdikt nad daným paketom. Tým verdiktom môže byť zahodenie paketu, posunutie paketu ďalej kernelu, poslanie paketu von na sieť vstupným rozhraním, či presmerovanie paketu na iné rozhranie. XDP môže pracovať v jednom z troch módov, a to buď v natívnom móde, kde XDP program sa nachádza v ovládači, paket sa do jadra nekopíruje a inštrukcie vykonáva procesor počítača, alebo v offloaded móde, kde inštrukcie sú vykonávané samot- nou sieťovou kartou, alebo v generickom móde, pre ktorý nie je potrebná podpora ovládača a je určená primárne pre účely vývoja. Z predošlých poznatkov bol navrhnutý filtračný systém, ktorého jadrom je eBPF pro- gram vložený do sieťovej karty, volaný ovládačom pomocou XDP rozhrania. Cieľový op- eračný systém pre túto filtráciu je platforma routerov NETX vyvíjaná na pôde univerzity Vysokého Učení Technického v Brně. Definujeme isté požiadavky na výkonnosť riešenia a na použitie vhodných vlastností, ktoré eBPF a XDP prinášajú. Následne je do detailu popísaný implementovaný filtračný mechanizmus. Popisujeme, ako sa daný XDP program implementovaný v jazyku C prekladá v dvoch krokoch prekladač- mi clang a llc zo súboru prekladačov projektu Low Level Virtual Machine (LLVM). Druhý program tohoto riešenia je určený na zavádzanie a odstraňovanie
Load more

Recommended publications
  • BERKELEY PACKET FILTER: Theory, Practice and Perspectives
    Alma Mater Studiorum · Universita` di Bologna SCUOLA DI SCIENZE Corso di Laurea in Informatica BERKELEY PACKET FILTER: theory, practice and perspectives Relatore: Presentata da: Chiar.mo Prof. MICHELE DI STEFANO RENZO DAVOLI Sessione II Anno Accademico 2019/2020 All operating systems sucks, but Linux just sucks less. Linus Torvalds Introduction Initially packet filtering mechanism in many Unix versions was imple- mented in the userspace, meaning that each packet was copied from the kernel-space to the user-space before being filtered. This approach resulted to be inefficient compared with the performance shown by the introduction of the BSD classic Berkeley Packet Filter (cBPF). cBPF consists of an as- sembly language for a virtual machine which resides inside the kernel. The assembly language can be used to write filters that are loaded in to the ker- nel from the user-space allowing the filtering to happen in the kernel-space without copying each packet as before. cBPF use is not limited to just the networking domain but it is also applied as a mechanism to filter system calls through seccomp mode. Seccomp allows the programmer to arbitrary select which system calls to permit, representing an useful mechanism to implement sandboxing. In order to increase the number of use cases and to update the architecture accordingly to new advancements in modern processors, the virtual machine has been rewritten and new features have been added. The result is extended Berkeley Packet Filter (eBPF) which consists of a richer assembly, more pro- gram types, maps to store key/value pairs and more components. Currently eBPF (or just BPF) is under continuous development and its capacities are evolving, although the main uses are networking and tracing.
    [Show full text]
  • Performance Evaluation of Express Data Path for Container-Based Network Functions
    Performance Evaluation of eXpress Data Path for Container-Based Network Functions Tugce Özturk School of Electrical Engineering Thesis submitted for examination for the degree of Master of Science in Technology. Espoo 30.12.2020 Supervisor Prof. Raimo Kantola Advisor M. Sc. Riku Kaura-aho Copyright © 2020 Tugce Özturk Aalto University, P.O. BOX 11000, 00076 AALTO www.aalto.fi Abstract of the master’s thesis Author Tugce Özturk Title Performance Evaluation of eXpress Data Path for Container-Based Network Functions Degree programme Computer, Communication and Information Sciences Major Communications Engineering Code of major ELEC3029 Supervisor Prof. Raimo Kantola Advisor M. Sc. Riku Kaura-aho Date 30.12.2020 Number of pages 65 Language English Abstract The architectural shift in the implementations of Network Function Virtualization (NFV) has necessitated improvements in the networking performance of commodity servers in order to meet the requirements of new generation networks. To achieve this, many fast packet processing frameworks have been proposed by academia and industry, one of them being eXpress Data Path (XDP) incorporated in the Linux kernel. XDP differentiates from other packet processing frameworks by leveraging the in-kernel facilities and running in device driver context. In this study, the XDP technology is evaluated to address the question of supporting performance needs of container-based virtual network functions in cloud architectures. Thus, a prototype consisting of a data plane powered by XDP programs and a container layer emulating the virtual network function is implemented, and used as a test-bed for throughput and CPU utilization measurements. The prototype has been tested to investigate the scalability with varying traffic loads as well as to reveal potential limitations of XDP in such a deployment.
    [Show full text]
  • Towards a Faster Iptables in Ebpf
    POLITECNICO DI TORINO Master of Science in Computer Engineering Master Thesis Towards a faster Iptables in eBPF Supervisor Prof. Fulvio Risso Candidate Massimo Tumolo PoliMi Supervisor Prof. Antonio Capone Academic year 2017-2018 To my family. You did more then you could for me to get here, I hope I will be as great to my children as you were to me. Alla mia famiglia. Avete fatto oltre il possibile per farmi arrivare qui, e spero di poter essere per i miei figli quanto voi siete per me. i Acknowledgements I would like to acknowledge my supervisor, or my mentor, Prof. Fulvio Risso. He trusted me to work on this project, he believed in me and helped me through all the steps. This thesis has been a wonderful opportunity to grow personally and professionally, and everything I learned was thanks to the opportunities he opened for me. A huge acknowledgment goes to Matteo Bertrone. He developed this thesis with me, we had (very) long chats on problems, possible solutions, and consequent prob- lems. We had some coffee just to talk. He was a really nice friend and collaborator. Thanks. Thank you to Sebastiano Miano, for being a good friend and a source of precious tips. I owe him a bunch of coffees that he offered during our chats. And thank you for suggesting me my favorite pizza place in Turin. Thank you to Mauricio Vásquez Bernal, for teaching me a lot on eBPF, and for being always available to provide me with help and informations. Last but not least, thank you to Simona.
    [Show full text]
  • Leveraging Kernel Tables with XDP
    Leveraging Kernel Tables with XDP David Ahern Cumulus Networks Mountain View, CA, USA [email protected] Abstract the popularity of specialized packet processing toolkits XDP is a framework for running BPF programs in the NIC driver such as DPDK. These frameworks enable unique, opaque to allow decisions about the fate of a received packet at the power-sucking solutions that bypass the Linux networking earliest point in the Linux networking stack. For the most part the stack and really make Linux nothing more than a boot OS BPF programs rely on maps to drive packet decisions, maps that from a networking perspective. are managed, for example, by a user space agent. While high Recently, eBPF has exploded in Linux with the ability to performant, this architecture has implications on how a solution is install small programs at many attach points across the coded, configured, monitored and debugged. kernel enabling a lot of on-the-fly programmability. One An alternative approach is to make the existing kernel specific use case of this larger eBPF picture is called XDP networking tables and implementations accessible by BPF (eXpress Data Path) [1]. XDP refers to BPF programs run programs. This approach allows the use of standard Linux APIs by the NIC driver on each packet received to allow and tools to manage networking configuration and state while still decisions about the fate of a packet at the earliest point in achieving the higher performance provided by XDP. Allowing the Linux networking stack (Figure 1). Targeted use cases XDP programs to access kernel tables enables consistency in for XDP include DDOS protections via an ACL [2], packet automation and monitoring across a data center – software mangling and redirection as a load balancer [3], and fast forwarding, hardware offload and XDP “offload”.
    [Show full text]
  • Performance Implications of Packet Filtering with Linux Ebpf
    Performance Implications of Packet Filtering with Linux eBPF Dominik Scholz, Daniel Raumer, Paul Emmerich, Alexander Kurtz, Krzysztof Lesiak and Georg Carle Chair of Network Architectures and Services, Department of Informatics, Technical University of Munich scholzd raumer emmericp kurtz lesiak carle @in.tum.de { | | | | | } Abstract—Firewall capabilities of operating systems are tra- not only used on UNIX-based systems. By the time a packet ditionally provided by inflexible filter routines or hooks in the is filtered in kernel space, rejected traffic already caused kernel. These require privileged access to be configured and are overhead, as each single packet was copied to memory and not easily extensible for custom low-level actions. Since Linux 3.0, the Berkeley Packet Filter (BPF) allows user-written extensions in underwent basic processing. To circumvent these problems, the kernel processing path. The successor, extended BPF (eBPF), two trends for packet filtering can be observed: Either the improves flexibility and is realized via a virtual machine featuring filtering is moved to a lower level leveraging hardware support both a just-in-time (JIT) compiler and an interpreter running in (e.g., offloading features or FPGA-based NICs), or breaking the kernel. It executes custom eBPF programs supplied by the up the ruleset and moving parts to user space. user, effectively moving kernel functionality into user space. We present two case studies on the usage of Linux eBPF. In this paper we show how eBPF can be used to break up the First, we analyze the performance of the eXpress Data Path conventional packet filtering model in Linux, even in environ- (XDP).
    [Show full text]
  • Faster OVS Datapath with XDP
    Faster OVS Datapath with XDP Toshiaki Makita William Tu [email protected] [email protected] NTT VMware NSBU Abstract 1.2 Open vSwitch and XDP XDP is fast and flexible, but difficult to use as it requires people OVS is widely used in virtualized data center environments as a to develop eBPF programs which often needs deep knowledge of software switching layer for a variety of operating systems. As eBPF. In order to mitigate this situation and to let people easily OVS is on the critical path, concerns about performance affect the use an XDP-based fast virtual switch, we introduce Open vSwitch architecture and features of OVS. For complicated configurations, (OVS) acceleration by XDP. OVS’s flow-based configuration can require huge rule sets. The key This has been already partly realized by recently introduced to OVS’s forwarding performance is flow caching. As shown in OVS netdev type, afxdp. Afxdp netdev type bypasses kernel Figure 1(a), OVS consists of two major components: a slow path network stack through AF XDP sockets and handles packets in userspace process and a fast path caching component, called the userspace. Although its goal, bringing XDP’s flexibility to OVS datapath. datapath by enabling us to update the datapath without updating When a packet is received by the NIC, the host OS does some kernel, was different from acceleration, afxdp is basically faster initial processing before giving it to the OVS datapath. The dat- than OVS kernel module. However, compared to native XDP in apath first parses the packet to extract relevant protocol headers kernel (i.e.
    [Show full text]
  • Fast Packet Processing with Ebpf and XDP: Concepts, Code, Challenges and Applications
    X Fast Packet Processing with eBPF and XDP: Concepts, Code, Challenges and Applications MARCOS A. M. VIEIRA∗, MATHEUS S. CASTANHO, RACYUS D. G. PACÍFICO, ELERSON R. S. SANTOS, EDUARDO P. M. CÂMARA JÚNIOR, and LUIZ F. M. VIEIRA, Universidade Federal de Minas Gerais, Brazil Extended Berkeley Packet Filter (eBPF) is an instruction set and an execution environment inside the Linux kernel. It enables modification, interaction and kernel programmability at runtime. eBPF can beusedto program the eXpress Data Path (XDP), a kernel network layer that processes packets closer to the NIC for fast packet processing. Developers can write programs in C or P4 languages and then compile to eBPF instructions, which can be processed by the kernel or by programmable devices (e.g. SmartNICs). Since its introduction in 2014, eBPF has been rapidly adopted by major companies such as Facebook, Cloudflare, and Netronome. Use cases include network monitoring, network traffic manipulation, load balancing, and system profiling. This work aims to present eBPF to an inexpert audience, covering the main theoretical and fundamental aspects of eBPF and XDP, as well as introducing the reader to simple examples to give insight into the general operation and use of both technologies. CCS Concepts: • Networks → Programming interfaces; Middle boxes / network appliances; End nodes. Additional Key Words and Phrases: Computer Networking, Packet processing, Network functions ACM Reference Format: Marcos A. M. Vieira, Matheus S. Castanho, Racyus D. G. Pacífico, Elerson R. S. Santos, Eduardo P. M. Câmara Júnior, and Luiz F. M. Vieira. 2019. Fast Packet Processing with eBPF and XDP: Concepts, Code, Challenges and Applications.
    [Show full text]
  • XDP Express Data Path Used for Ddos Protection Learning Ebpf Code
    XDP – eXpress Data Path Used for DDoS protection Linux Kernel self protection Learn writing eBPF code Jesper Dangaard Brouer Principal Engineer, Red Hat Lund Linux Con 1/37 XDP – eXpress Data Path May, 2017 Audience: Prepare yourself! ● Git clone or fork ● https://github.com/netoptimizer/prototype-kernel/ ● XDP eBPF code example in directory: ● kernel/samples/bpf/ ● Documentation ● https://prototype-kernel.readthedocs.io/ ● Notice two “sections” ● XDP - eXpress Data Path ● eBPF - extended Berkeley Packet Filter 2/37 XDP – eXpress Data Path Overview ● What is XDP – eXpress Data Path ● Using XDP for DDoS protection 1) Linux Kernel self protection 2) Handling volume attacks with scrubbing ● Learn to write eBPF XDP code by examples ● Blacklist example ready to use ● Modify and adapt to DDoS attacks ● New mailing list ● [email protected] 3/37 XDP – eXpress Data Path Introduction ● An eXpress Data Path (XDP) in kernel-space ● The "packet-page" idea from NetDev1.1 "rebranded" ● Thanks to: Tom Herbert, Alexei and Brenden Blanco, putting effort behind idea ● Basic idea: work on raw packet-page inside driver ● Hook before any allocations or normal stack overhead ● Performance is primary focus and concern ● Target is competing with DPDK speeds ● No fancy features! ● Need features: use normal stack delivery 4/37 XDP – eXpress Data Path XDP: What is XDP (eXpress Data Path)? ● Thin layer at lowest levels of SW network stack ● Before allocating SKBs ● Inside device drivers RX function ● Operate directly on RX DMA packet-pages ● XDP is NOT kernel bypass ● Designed to work in concert with stack ● XDP - run-time programmability via "hook" ● Run eBPF program at hook point ● Learn writing eBPF code later..
    [Show full text]
  • XDP-Programmable Data Path in the Linux Kernel (PDF)
    XDP-Programmable Data Path in the Linux Kernel DIPTANUPROGRAMMING GON CHOUDHURY Diptanu Gon Choudhury works erkeley Packet Filter was introduced almost two decades ago and has on large-scale distributed been an important component in the networking subsystem of the systems. His interests lie in kernel for assisting with packet filtering. Extended BPF can do much designing large-scale cluster B schedulers, highly available more than that and is gradually finding its way into more kernel subsystems control plane systems, and high-performance as a generic event-processing infrastructure. In this article, I provide enough network services. He is the author of the background to help you understand how eBPF works, then describe a simple upcoming O’Reilly book Scaling Microservices. and fast firewall using Express Data Path (XDP) and eBPF. [email protected] Berkeley Packet Filter (BPF) has been around for more than two decades, born out of the requirement for fast and flexible packet filtering machinery to replace the early ’90s imple- mentations, which were no longer suitable for emerging processors. BPF has since made its way into Linux and BSDs via libpcap, which is the foundation of tcpdump. Instead of writing the packet filtering subsystem as a kernel module, which can be unsafe and fragile, McCanne and Jacobson designed an efficient yet minimal virtual machine in the kernel, which allows execution of bytecode in the data path of the networking stack. The virtual machine was very simple in design, providing a minimalistic RISC-based instruction set, with two 32-bit registers, but it was very effective in allowing developers to express logic around packet filtering.
    [Show full text]
  • XDP – Express Data Path an In-Kernel Network Fast-Path a Technology Overview
    XDP – eXpress Data Path An in-kernel network fast-path A technology overview Jesper Dangaard Brouer Principal Kernel Engineer, Red Hat Driving-IT, Denmark 3rd November 2017 1/27 XDP explained, Driving-IT 2017 Introduction ● This presentation is about XDP ● XDP – eXpress Data Path ● Why Linux need it ● Making people aware of this technology ● XDP: New in-kernel building block for networking ● Explaining the building blocks of XDP ● Help understand idea behind eBPF 2/27 XDP explained, Driving-IT 2017 What is the problem? ● Compared to bypass solutions, DPDK and netmap ● Linux kernel networking is said to be slow ● Fundamental reason: Linux build on assumption ● that most packets travel into sockets ● takes cost upfront of allocating a "socket buff" (sk_buff/SKB) ● Linux lacks an in-kernel fast-path ● DPDK bypass operate on "earlier" network layer ● Kernel lack network layer before allocating SKBs 3/27 XDP explained, Driving-IT 2017 Why is an in-kernel fast-path needed? ● Today everything relies on networking ● Kernel provides core foundation for network ● Solutions like DPDK: make networking an add-on ● No longer part of core foundation everybody share ● DPDK require maintaining full separate drivers ● Special kernel boot parameters, 100% CPU usage ● Harder to integrate into products/solutions ● e.g. takes over entire NIC ● e.g. DPDK and containers are not compatible ● e.g. you need to reimplement a TCP/IP stack ● Need in-kernel fast-path solution, part of core 4/27 XDP explained, Driving-IT 2017 What is XDP (eXpress Data Path)? ● XDP is
    [Show full text]